Sharp releases before 0.35.4 bundle a vulnerable libheif component that allows attackers to possibly execute arbitrary code on systems running glibc-based Linux when a specially crafted AVIF or HEIF image is processed. The flaw represents a heap-based buffer overflow (CWE-122) and a type of out-of-bounds memory access (CWE-787). The vulnerability gives remote code execution capabilities, potentially compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects the Sharp image processing library produced by lovell. All Sharp installations prior to version 0.35.4 are impacted, including any applications that rely on the bundled binaries from those releases.

The CVSS score of 8.9 indicates high severity, yet the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and can be executed via any network-facing application that accepts untrusted images processed with Sharp; an attacker must supply a malicious AVIF/HEIF image to trigger the flaw and no additional conditions are described in the advisory.